Quick answer
Learn how to compare a file against an official SHA-256 checksum locally and understand what a matching hash does and does not prove.
Use the related browser-only tool after reading the safety notes, then verify the output before sharing.
Quick answer
Get the expected SHA-256 value from the official source, calculate the SHA-256 hash of your local file, and compare the full 64-character hexadecimal value exactly.
If the values match, the file bytes match the expected checksum. If they do not match, do not trust or install the file until you understand why.
Find the official hash
Use the publisher's official website, release page, package registry, documentation, or signed release notes. Avoid checksums copied from comments, mirrors, random forums, or screenshots.
A checksum only helps if the expected value is trustworthy. If an attacker controls both the download and the checksum, the match does not prove safety.
Calculate the hash locally
Select the file in the Privacy Toolbox SHA-256 tool and wait for the browser to calculate the digest. The file is read locally and does not need to be uploaded to a remote server.
Modern browsers expose Web Crypto digest features that can calculate SHA-256 values from file bytes. Large files may require time and memory, so wait until the calculation completes.
Compare the full value
Compare every character. SHA-256 is usually displayed as 64 hexadecimal characters. Uppercase and lowercase letters can represent the same value, but missing, extra, or different characters mean the hash does not match.
Do not compare only the first few characters unless you are doing a quick informal check. For download verification, use the complete value.
What a match does not prove
A matching SHA-256 value proves the file matches the expected bytes. It does not prove the software is safe, the author is trustworthy, the file is malware-free, or the document is appropriate to open.
For higher-risk downloads, also use HTTPS, official sources, digital signatures when available, antivirus or platform warnings, and normal security judgment.
When to use SHA-256
Use SHA-256 when verifying software installers, compressed archives, disk images, shared backups, important document transfers, or any file where byte-level integrity matters.
Do not send private files to someone else just to calculate a hash. Use a local tool, and share only the hash value when appropriate.
FAQ
Does SHA-256 upload my file?
Not in Privacy Toolbox. The file is read locally in your browser to calculate the hash.
Can two different files have the same SHA-256?
SHA-256 is designed to make collisions extremely hard in practice, but no hash explanation should be treated as a complete security guarantee.
Why did the hash change after editing the file?
Any change to the file bytes, even a small edit or metadata change, produces a different SHA-256 value.
Is SHA-256 the same as encryption?
No. Hashing creates a fixed digest for verification. It does not encrypt the file or allow recovery of the original data.